AL-JANEF
UserSecurity skills suite for Claude Code — auth hardening, vuln audit, threat modeling, secrets detection. 4-layer detection, proof-before-done, no overclaiming.
Categories
Indexed Skills (8)
auth-hardening
Review, harden, and design authentication and session management for web applications — login, logout, session lifecycle, password storage, token handling, and brute-force protection. Use this skill whenever the user is building or reviewing sign-in / sign-out flows, JWT or session cookies, password hashing, "remember me", refresh tokens, account lockout, OTP/MFA, or password reset — even if they only mention "login" or "auth" casually. Applies to Node.js, Next.js, and similar stacks. Defensive only: this skill hardens auth systems, it does not bypass or attack them.
engineering-standard
Enforce a strict, production-grade engineering standard on any serious coding task — writing, reviewing, refactoring, debugging, or completing a feature. Applies correctness, security, performance, and maintainability discipline; bans placeholder/dead code and silent failures; requires evidence for every claim of success; and gates completion on lint, typecheck, tests, and build. Use this skill whenever the user is building or reviewing real application code, fixing a bug, or asking whether code is production-ready — especially in TypeScript/Node/Next.js and multi-tenant systems. It raises quality and rigor; it does not attack systems or bypass controls.
secrets-guard
Prevent secrets from leaking into code, git history, logs, or client bundles — API keys, database credentials, tokens, private keys, and connection strings. Detects hardcoded secrets, guides correct secret management (env vars, secret managers), and sets up prevention (gitignore, pre-commit scanning). Use this skill whenever the user is handling API keys or credentials, setting up environment variables, connecting to external services, committing config, or asks about keeping secrets safe — even a casual "where do I put my API key?". Defensive only.
security-logging
Design and review security audit logging and monitoring — recording who did what and when, detecting suspicious activity (repeated failed logins, unusual access), and doing it without leaking sensitive data into the logs themselves. Use this skill whenever the user is building audit trails, adding logging to sensitive actions, setting up monitoring or alerting, investigating an incident, or asks "how do I track who did X?" — especially for auth events, data changes, and admin actions. Defensive only.
threat-model
Run a structured threat-modeling pass at the design stage — before code — to find security risks in an architecture or feature. Uses STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) to systematically ask "how could this be attacked?". Use this skill whenever the user is designing a system, planning a new feature, drawing an architecture, defining APIs, or asks "what could go wrong security-wise?" — especially before implementation begins. Defensive only: it identifies risks and mitigations, it does not plan attacks.
vuln-audit
Audit web application code for common vulnerabilities — the OWASP Top 10 class of bugs: injection (SQL/NoSQL/command), XSS, CSRF, SSRF, IDOR / broken access control, insecure deserialization, unsafe file upload, and security misconfiguration. Use this skill whenever the user asks to review code for security, find vulnerabilities, do a security pass before shipping, or is writing code that handles user input, database queries, file uploads, or external requests — even if they only say "review this" or "is this safe?". Defensive only: this skill finds and fixes weaknesses, it does not write exploits.
variant-hunt
After any vulnerability or bug is found, hunt the entire codebase for every other instance of the same pattern — because one bug is almost never alone. Turns a single finding into a systematic sweep using ripgrep and custom Semgrep rules, so the whole class gets fixed, not just the reported case. Use this skill right after finding or fixing a security issue, when reviewing whether a fix is complete, or when a past incident's pattern must be proven eradicated. Defensive only: it finds and eradicates weaknesses, it does not exploit them.
janef
Advanced orchestrated security & engineering command — the command layer of the janefskills suite. Invoke with /janef to run a rigorous, multi-layer security review that combines real automated tooling (Semgrep SAST, Gitleaks secret scanning, dependency audit) with expert LLM review, professional audit methodology (variant analysis, fix verification, timing/constant-time review), and an honest coverage verdict. Routes single tasks to the right specialist (auth-hardening, vuln-audit, threat-model, secrets-guard, security-logging, engineering-standard) or runs a full audit-grade pass. Use whenever the user wants a serious security review. Defensive only: it finds, verifies, and fixes — it never writes exploits or attacks systems.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.